@objectstack/rest 14.8.0 → 15.1.0

package/dist/index.cjs

@@ -258,6 +258,9 @@ var RouteGroupBuilder = class {
   }
 };
 
+// src/rest-server.ts
+var import_security = require("@objectstack/spec/security");
+
 // src/export-format.ts
 function exportContentDisposition(objectName, label, ext, now = /* @__PURE__ */ new Date()) {
   const pad = (n) => String(n).padStart(2, "0");
@@ -307,6 +310,7 @@ function buildFieldMetaMap(schema) {
       options: Array.isArray(f.options) ? f.options : void 0,
       reference: typeof f.reference === "string" ? f.reference : void 0,
       displayField: typeof f.displayField === "string" ? f.displayField : void 0,
+      multiple: f.multiple === true,
       required: f.required === true,
       system: f.system === true,
       readonly: f.readonly === true,
@@ -428,6 +432,14 @@ var OPTION_TYPES2 = /* @__PURE__ */ new Set(["select", "radio"]);
 var MULTI_OPTION_TYPES2 = /* @__PURE__ */ new Set(["multiselect", "checkboxes", "tags"]);
 var NUMBER_TYPES = /* @__PURE__ */ new Set(["number", "currency", "percent", "rating", "slider"]);
 var BOOL_TYPES = /* @__PURE__ */ new Set(["boolean", "toggle"]);
+var FILE_TYPES = /* @__PURE__ */ new Set(["file", "image"]);
+var MULTI_CAPABLE_TYPES = /* @__PURE__ */ new Set(["select", "radio", "lookup", "user", "file", "image"]);
+function isMultiValueField(meta) {
+  const t = meta?.type;
+  if (!t) return false;
+  if (MULTI_OPTION_TYPES2.has(t)) return true;
+  return MULTI_CAPABLE_TYPES.has(t) && meta?.multiple === true;
+}
 function normalizeRefMatch(result) {
   if (result == null) return {};
   if (typeof result === "string") return result ? { id: result } : {};
@@ -545,7 +557,23 @@ async function coerceFieldValue(raw, meta, ctx) {
     if (d === void 0) return { error: { field, code: "invalid_date", message: `${field}: "${String(raw)}" is not a valid ${t}` } };
     return { value: d };
   }
-  if (OPTION_TYPES2.has(t)) {
+  if (OPTION_TYPES2.has(t) || MULTI_OPTION_TYPES2.has(t)) {
+    if (isMultiValueField(meta)) {
+      const parts = splitMulti(raw);
+      const out = [];
+      for (const part of parts) {
+        const v2 = matchOption(part, meta?.options);
+        if (v2 === void 0) {
+          if (ctx.createMissingOptions) {
+            out.push(part);
+            continue;
+          }
+          return { error: { field, code: "invalid_option", message: `${field}: "${part}" is not a known option` } };
+        }
+        out.push(v2);
+      }
+      return { value: out };
+    }
     const v = matchOption(raw, meta?.options);
     if (v === void 0) {
       if (ctx.createMissingOptions) return { value: String(raw).trim() };
@@ -553,23 +581,23 @@ async function coerceFieldValue(raw, meta, ctx) {
     }
     return { value: v };
   }
-  if (MULTI_OPTION_TYPES2.has(t)) {
-    const parts = splitMulti(raw);
-    const out = [];
-    for (const part of parts) {
-      const v = matchOption(part, meta?.options);
-      if (v === void 0) {
-        if (ctx.createMissingOptions) {
-          out.push(part);
-          continue;
-        }
-        return { error: { field, code: "invalid_option", message: `${field}: "${part}" is not a known option` } };
+  if (REFERENCE_TYPES2.has(t)) {
+    if (isMultiValueField(meta)) {
+      const tokens = splitMulti(raw);
+      if (!ctx.resolveRef || !meta.reference) return { value: tokens };
+      const out = [];
+      for (const token of tokens) {
+        const m = normalizeRefMatch(await ctx.resolveRef(meta.reference, token, meta));
+        if (m.ambiguous) {
+          return { error: { field, code: "reference_ambiguous", message: `${field}: "${token}" matches more than one ${meta.reference} \u2014 use a unique value or the record id` } };
+        }
+        if (m.id === void 0) {
+          return { error: { field, code: "reference_not_found", message: `${field}: no ${meta.reference} matches "${token}"` } };
+        }
+        out.push(m.id);
       }
-      out.push(v);
+      return { value: out };
     }
-    return { value: out };
-  }
-  if (REFERENCE_TYPES2.has(t)) {
     const display = String(raw).trim();
     if (!ctx.resolveRef || !meta?.reference) return { value: display };
     const match = normalizeRefMatch(await ctx.resolveRef(meta.reference, display, meta));
@@ -581,6 +609,9 @@ async function coerceFieldValue(raw, meta, ctx) {
     }
     return { value: match.id };
   }
+  if (FILE_TYPES.has(t) && isMultiValueField(meta)) {
+    return { value: splitMulti(raw) };
+  }
   return { value: trim && typeof raw === "string" ? raw.trim() : raw };
 }
 var REQUIRED_CHECK_SKIP = /* @__PURE__ */ new Set([
@@ -631,6 +662,10 @@ function toFailedResult(rowNo, err) {
   return { row: rowNo, ok: false, action: "failed", error: message, code };
 }
 var MAX_CREATE_BATCH_SIZE = 200;
+var yieldToEventLoop = () => new Promise((resolve) => {
+  if (typeof setImmediate === "function") setImmediate(resolve);
+  else setTimeout(resolve, 0);
+});
 function runImport(opts) {
   const {
     p,
@@ -849,8 +884,9 @@ function runImport(opts) {
         await flushPendingCreates();
         if (onProgress) await onProgress(snapshot(processed));
       }
-      if (shouldCancel && processed < rows.length && processed % progressEvery === 0) {
-        if (await shouldCancel()) {
+      if (processed < rows.length && processed % progressEvery === 0) {
+        await yieldToEventLoop();
+        if (shouldCancel && await shouldCancel()) {
           cancelled = true;
           break;
         }
@@ -1114,7 +1150,7 @@ async function prepareImportRequest(body, opts) {
   const dryRun = body?.dryRun === true;
   let writeMode = body?.writeMode === "update" || body?.writeMode === "upsert" ? body.writeMode : "insert";
   let matchFields = Array.isArray(body?.matchFields) ? body.matchFields.filter((f) => typeof f === "string" && f.length > 0) : [];
-  const runAutomations = body?.runAutomations === true;
+  const runAutomations = body?.runAutomations !== false;
   const trimWhitespace = body?.trimWhitespace !== false;
   const nullValues = Array.isArray(body?.nullValues) ? body.nullValues.filter((v) => typeof v === "string") : void 0;
   const createMissingOptions = body?.createMissingOptions === true;
@@ -1275,6 +1311,16 @@ function mapDataError(error, object) {
       }
     };
   }
+  if (error?.code === "ATTACHMENT_PARENT_ACCESS" || error?.code === "ATTACHMENT_DELETE_DENIED") {
+    return {
+      status: 403,
+      body: {
+        error: error?.message ?? "Attachment access denied",
+        code: error.code,
+        ...error?.object || object ? { object: error?.object ?? object } : {}
+      }
+    };
+  }
   if (error?.code === "PERMISSION_DENIED" || error?.name === "PermissionDeniedError" || typeof error?.message === "string" && error.message.startsWith("[Security] Access denied")) {
     return {
       status: 403,
@@ -1294,6 +1340,17 @@ function mapDataError(error, object) {
       }
     };
   }
+  if (typeof error?.status === "number" && error.status >= 400 && error.status < 500) {
+    const msg = typeof error?.message === "string" && error.message.length > 0 && error.message.length < 500 ? error.message : "Request failed";
+    return {
+      status: error.status,
+      body: {
+        error: msg,
+        ...typeof error?.code === "string" && error.code ? { code: error.code } : {},
+        ...object ? { object } : {}
+      }
+    };
+  }
   const raw = String(error?.message ?? error ?? "");
   const lower = raw.toLowerCase();
   const sandboxWrapper = /^(?:hook|action) '[^']*' threw:\s*(.+)$/s.exec(raw);
@@ -1743,14 +1800,16 @@ var RestServer = class _RestServer {
       res.status(403).json({ error: { code: gate.code, message: gate.message } });
       return true;
     }
-    if (!this.config.api.requireAuth) return false;
-    if (context?.userId) return false;
-    if (req?.method === "OPTIONS") return false;
-    res.status(401).json({
-      error: "unauthenticated",
-      message: "Authentication is required to access this endpoint."
-    });
-    return true;
+    if ((0, import_core2.shouldDenyAnonymous)({
+      requireAuth: this.config.api.requireAuth,
+      userId: context?.userId,
+      isSystem: context?.isSystem,
+      method: req?.method
+    })) {
+      res.status(import_core2.ANONYMOUS_DENY_STATUS).json(import_core2.ANONYMOUS_DENY_BODY);
+      return true;
+    }
+    return false;
   }
   /**
    * Enforce object-level API exposure (ObjectSchema `enable.apiEnabled` /
@@ -1968,6 +2027,10 @@ var RestServer = class _RestServer {
         permissions: authz.permissions,
         systemPermissions: authz.systemPermissions,
         ...authz.tabPermissions ? { tabPermissions: authz.tabPermissions } : {},
+        // [ADR-0095 D2 / #2947] Carry the derived posture rung so the
+        // enforcement side reads the SAME value the resolver computed,
+        // instead of dropping it here (the boundary this issue closes).
+        ...authz.posture ? { posture: authz.posture } : {},
         isSystem: false,
         org_user_ids: authz.org_user_ids,
         ...authGate ? { authGate } : {},
@@ -3497,7 +3560,7 @@ var RestServer = class _RestServer {
             res.json(result);
           } catch (error) {
             const mapped = mapDataError(error, req.params?.object);
-            if (mapped.status === 404 || mapped.status === 503 || mapped.status === 502) {
+            if (isExpectedDataStatus(mapped.status) || mapped.body?.code === "UNSUPPORTED_QUERY_PARAM") {
               res.status(mapped.status).json(mapped.body);
             } else {
               logError("[REST] Unhandled error:", error);
@@ -3789,6 +3852,16 @@ var RestServer = class _RestServer {
         tags: ["data", "import"]
       }
     });
+    const loadImportJob = async (p, jobId, environmentId, context) => {
+      const r = await p.findData({
+        object: IMPORT_JOB_OBJECT,
+        query: { $filter: { id: jobId }, $top: 1 },
+        ...environmentId ? { environmentId } : {},
+        ...context ? { context } : {}
+      });
+      const rows = Array.isArray(r?.records) ? r.records : Array.isArray(r?.data) ? r.data : Array.isArray(r?.rows) ? r.rows : Array.isArray(r) ? r : [];
+      return rows[0];
+    };
     this.routeManager.register({
       method: "POST",
       path: `${dataPath}/:object/import/jobs`,
@@ -3854,6 +3927,11 @@ var RestServer = class _RestServer {
           };
           const captureUndo = !prepared.dryRun && prepared.rows.length <= IMPORT_JOB_UNDO_MAX_ROWS;
           void (async () => {
+            if (this.cancelledImportJobs.has(jobId)) {
+              this.cancelledImportJobs.delete(jobId);
+              await patch({ status: "cancelled", completed_at: (/* @__PURE__ */ new Date()).toISOString() });
+              return;
+            }
             await patch({ status: "running", started_at: (/* @__PURE__ */ new Date()).toISOString() });
             try {
               const summary = await runImport({
@@ -3871,10 +3949,27 @@ var RestServer = class _RestServer {
                   skipped_count: pr.skipped,
                   error_count: pr.errors
                 }),
-                shouldCancel: () => this.cancelledImportJobs.has(jobId)
+                shouldCancel: async () => {
+                  if (this.cancelledImportJobs.has(jobId)) return true;
+                  try {
+                    const row = await loadImportJob(p, jobId, environmentId, context);
+                    return String(row?.status ?? "") === "cancelled";
+                  } catch {
+                    return false;
+                  }
+                }
               });
+              let finalStatus = summary.cancelled ? "cancelled" : "succeeded";
+              if (finalStatus === "succeeded" && this.cancelledImportJobs.has(jobId)) finalStatus = "cancelled";
+              if (finalStatus === "succeeded") {
+                try {
+                  const row = await loadImportJob(p, jobId, environmentId, context);
+                  if (String(row?.status ?? "") === "cancelled") finalStatus = "cancelled";
+                } catch {
+                }
+              }
               await patch({
-                status: summary.cancelled ? "cancelled" : "succeeded",
+                status: finalStatus,
                 processed_rows: summary.processed,
                 created_count: summary.created,
                 updated_count: summary.updated,
@@ -3904,16 +3999,6 @@ var RestServer = class _RestServer {
         tags: ["data", "import"]
       }
     });
-    const loadImportJob = async (p, jobId, environmentId, context) => {
-      const r = await p.findData({
-        object: IMPORT_JOB_OBJECT,
-        query: { $filter: { id: jobId }, $top: 1 },
-        ...environmentId ? { environmentId } : {},
-        ...context ? { context } : {}
-      });
-      const rows = Array.isArray(r?.records) ? r.records : Array.isArray(r?.data) ? r.data : Array.isArray(r?.rows) ? r.rows : Array.isArray(r) ? r : [];
-      return rows[0];
-    };
     this.routeManager.register({
       method: "POST",
       path: `${dataPath}/import/jobs/:jobId/cancel`,
@@ -4497,6 +4582,7 @@ var RestServer = class _RestServer {
                 }
                 const fields = {};
                 for (const [name, def] of Object.entries(obj.fields)) {
+                  if (import_security.PUBLIC_FORM_SERVER_MANAGED_FIELDS.has(name)) continue;
                   if (allowed.size === 0 || allowed.has(name)) {
                     fields[name] = def;
                   }
@@ -4521,6 +4607,7 @@ var RestServer = class _RestServer {
           const safeForm = (() => {
             if (!match.form || !Array.isArray(match.form.sections)) return match.form;
             const allow = (name, cfg) => {
+              if (import_security.PUBLIC_FORM_SERVER_MANAGED_FIELDS.has(name)) return false;
               const def = objectSchema?.fields?.[name];
               const t = def?.type;
               if (t !== "lookup" && t !== "master_detail" && t !== "user") return true;
@@ -4586,12 +4673,10 @@ var RestServer = class _RestServer {
           }
           const rawBody = req.body && typeof req.body === "object" ? req.body : {};
           const filteredData = {};
-          if (allowedFields.size > 0) {
-            for (const [k, v] of Object.entries(rawBody)) {
-              if (allowedFields.has(k)) filteredData[k] = v;
-            }
-          } else {
-            Object.assign(filteredData, rawBody);
+          for (const [k, v] of Object.entries(rawBody)) {
+            if (import_security.PUBLIC_FORM_SERVER_MANAGED_FIELDS.has(k)) continue;
+            if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+            if (allowedFields.size === 0 || allowedFields.has(k)) filteredData[k] = v;
           }
           const context = {
             publicFormGrant: { object: match.object },
@@ -4640,15 +4725,17 @@ var RestServer = class _RestServer {
             return;
           }
           let fieldCfg = null;
-          for (const sec of match.form?.sections ?? []) {
-            for (const f of sec?.fields ?? []) {
-              const name = typeof f === "string" ? f : f?.field;
-              if (name === fieldName) {
-                fieldCfg = typeof f === "string" ? {} : f;
-                break;
+          if (!import_security.PUBLIC_FORM_SERVER_MANAGED_FIELDS.has(fieldName)) {
+            for (const sec of match.form?.sections ?? []) {
+              for (const f of sec?.fields ?? []) {
+                const name = typeof f === "string" ? f : f?.field;
+                if (name === fieldName) {
+                  fieldCfg = typeof f === "string" ? {} : f;
+                  break;
+                }
               }
+              if (fieldCfg) break;
             }
-            if (fieldCfg) break;
           }
           const picker = fieldCfg?.publicPicker;
           if (!picker) {
@@ -4906,12 +4993,15 @@ var RestServer = class _RestServer {
         const parsed = ExplainRequestSchema.safeParse({
           object: src.object,
           operation: src.operation ?? "read",
-          ...src.userId != null && src.userId !== "" ? { userId: src.userId } : {}
+          ...src.userId != null && src.userId !== "" ? { userId: src.userId } : {},
+          // [C2 / ADR-0095] Optional record id — explains ONE concrete
+          // row at record granularity; omitted stays object-level.
+          ...src.recordId != null && src.recordId !== "" ? { recordId: src.recordId } : {}
         });
         if (!parsed.success) {
           return res.status(400).json({
             code: "VALIDATION_FAILED",
-            message: "Invalid explain request \u2014 expected { object: string, operation: read|create|update|delete|transfer|restore|purge, userId?: string }.",
+            message: "Invalid explain request \u2014 expected { object: string, operation: read|create|update|delete|transfer|restore|purge, userId?: string, recordId?: string }.",
             detail: String(parsed.error?.message ?? "").slice(0, 1e3)
           });
         }